Skip to content

LIVING OFF THE LAND / OS BINARIES

Cipher.exe

File Encryption Utility

02COMMAND EXAMPLES

02ATT&CK TECHNIQUES

01DETECTION RESOURCES

01CAPABILITIES

01 / TRADECRAFT

Command reference

2 examples

Tamper2

EXAMPLE 01T1485

Zero out a file

COMMAND

cipher /w:{PATH_ABSOLUTE:folder}

USE CASE: Can be used to forensically erase a file.
PRIVILEGES: User
OPERATING SYSTEM: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

EXAMPLE 02T1562

Encrypt a file

COMMAND

cipher.exe /e {PATH_ABSOLUTE}

USE CASE: Can be used to impair defences by e.g. encrypting a critical EDR solution file.
PRIVILEGES: Admin
OPERATING SYSTEM: Windows 10

02 / ON DISK

Known paths

c:\windows\system32\cipher.exe

c:\windows\syswow64\cipher.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Sigmaproc_creation_win_cipher_overwrite_deleted_data.ymlgithub.com

Indicators & detection notes

IOC
cipher.exe process with /w on the command line

FURTHER READING

Research & resources

READthe nearest neighbor attack how a russian apt weaponized nearby wi fi networks for covert accesswww.volexity.com

COMMUNITY RESEARCH

Acknowledgements

Ade Ogunsowo@i_am_tutu

Alexander Sennhauser@conitrade